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Wiih  this  first  edition  of 
the  Auditor's  Notebook. 
we  are  introducing  a 
significant  initiative  of  the 
Office  of  the  State  Auditor 
(OSA).  This  pubHcation  is  a 
journal  that  will  provide  ab- 
stracts of  professional  articles 
and  will  serve  as  an  important 
meaas  of  presenting  practical, 
technical  information  appli- 
cable to  the  work  of  govern- 
ment auditors. 


The  notebook  will  include 
up-to-date  information,  trends, 
and  developments  in  the  field  of  auditing  to 
assist  in  performing  audit  work  that  will  ulti- 
mately be  more  useful  to  state  program  officials. 
Auditing  and  accounting  journals  from  across 
the  country  will  be  reviewed,  and  articles  will 
be  abstracted  to  provide  current  and  relevant  in- 
formation. 

The  information  provided  in  the  Auditor's 
Notebook  will  serve  as  a  timely  supplement  to 
the  wide  range  of  training  axxl  educational  pro- 
grams in  the  areas  of  planning,  sampling  tech- 
niques, evidence  gathering,  workpaper  prepara- 
tion, reporting,  and  auditee  relations  that  have 
already  been  developed  by  the  OSA's  Human 
Resource  Management  Division  and  Audit 
Operations.  TTie  notebook,  which  will  be  pro- 
duced on  a  regular  basis,  should  be  a  helpful  tool 
in  keeping  staff  informed  of  changes  in  the 
teclinology  of  auditing  that  are  applicable  to  the 
way  the  OSA  implements  and  practices  the  stan- 
dards of  the  profession. 

One  of  my  goals  as  Auditor  is  to  improve  the 
way  state  government  operates  its  programs  and 
manages  its  resources.  We  are  meeting  that  goal 
by  working  constructively  and  cooperatively 
with  all  parties  to  assist  the  Legislature,  state  ex- 
ecutives, and  program  managers  in  economi- 
cally, efficiently,  and  effectively  carrying  out 
their  mandated  responsibilities. 


A.  Joseph  DeNucci,  Auditor 


achievements  that  have  al- 
lowed us  to  become  a  more 
progressive,  professional  and 
timely  audit  organization.  Our 
successful  efforts  with  the  Tax- 
Cap  Audit,  the  Cash  Cut-Off 
Audit  and  the  Encumbrance 
and  Advance  Funds  Manage- 
ment Audit  have  given  the 
OSA  a  central  role  in  the  finan- 
cial and  program  management 
of  state  government. 


The  field  staffs  implemen- 
tation of  the  1988  Audit  Plan  is  the  most  signifi- 
cant factor  for  ensuring  that  our  ambitious 
agenda  is  achieved.  Without  a  commitment  to 
the  goals  of  the  Audit  Plan,  and  a  desire  to 
acquire  and  enhance  the  skills  necessary  to  carry 
it  out,  the  Audit  Plan  remains  little  more  than  an 
untested  concept  of  great  potential. 

To  ensure  the  continued  success  of  these  ef- 
forts, and  to  conform  to  the  OSA's  enabling  leg- 
islation, I  have  restructured  Audit  Operations. 
The  restructuring  increases  the  OSA's  effective- 
ness and  efficiency  by  creating  areas  of  speciali- 
zation that  will  improve  our  ability  to  identify 
problems  in  the  Commonwealth's  fmancial 
management  systems  on  a  statewide  basis. 

Our  Audit  Plan  includes  many  important 
audit  initiatives  designed  to  improve  the  ac- 
countability of  government  and  the  programs  it 
delivers  to  the  citizens  of  the  Commonwealth. 
The  Auditor's  Notebook  is  one  of  a  series  of 
efforts  that  will  assist  the  Office  of  the  State 
Auditor's  staff  in  fully  realizing  the  challenges 
of  its  mandate. 


DeT^ucci 
Aiiditor  of  the  Commonwealth 


OSA 

Office  of  the 
State  Auditor 


The  Expanding  Role  of  the  Auditor 


There  is  an  old  joke  amongst  auditors  which 
states  that  there  are  two  big  Ues  in  auditing. 
The  first  is  when  the  auditors  say,  "We're 
here  to  help,"  and  the  second  is  the  client's  re- 
sponse, "We're  glad  you're  here."  This  may 
bring  a  smile  to  the  face  of  some,  but  recent 
studies  indicate  there  is  some  truth  to  the  joke. 

The  object  of  an  audit  is  to  provide  respon- 
sible people  with  reliable  information  upon 
which  they  can  base  decisions.  The  February, 
1986  issue  of  the  Journal  of  Accountancy  reports 
studies  which  in- 


dicate that  those 
who  should  be  us- 
ing audit  reports 
very  often  do  not 
understand  them 


The  object  of  an  audit  is  to 
provide  responsible  people 
This  seems  a  pe-  with  reliable  information  upon 

culiar     finding  i  ■•• 

when  one  consid  which  they  cau  base  decisions. 

ers  that  the  - 
auditor's  standard 


report  format  is  approximately  forty  years  old. 
The  explanation  may  lie  in  the  fact  that  the 
report  format  is  designed  for  the  auditor  and  not 
for  the  client. 

The  struggle  to  get  clients  to  be  more  appre- 
ciative of  the  efforts  of  the  auditors  is  as  old  as 
the  profession.  The  problem  appears  to  be 
complex.  The  client  very  often  is  unsure  of  what 
the  auditor  is  looking  for,  and  why.  It  follows, 
then,  that  the  second  problem  concerns  the 
client's  ability  to  use  the  audit  information  to 
improve  practices. 

Since  GAAS  and  GAGAS  set  high  standards 
for  quality,  the  problem  cannot  be  blamed  solely 
on  the  quality  of  audit  work.  It  is  also  not  in 
the  complexity  of  the  reports,  as  the  format  is 
at  least  familiar  after  forty  years  of  usage.  The 
problem  is  in  communications  —  before,  during 
and  after  the  audit. 

This  seems,  at  first,  a  simple  problem  to  ad- 
dress. In  fact,  most  audit  organizations  offer 
courses  in  interviewing  and  writing  skills.  Yet, 
the  Journal  of  Accountancy  reports  that  the  gap 
between  the  auditor's  goal  in  writing  the  report, 
and  the  client's  ability  to  understand  and  use  the 
information,  continues  to  grow. 


Communication  skills  can  be  developed  and 
improved.  A  comprehensive  professional  devel- 
opment program  concentrates  on  these  skills  as 
well  as  on  auditing/accounting  techniques.  That 
is  a  goal  which  can  be  effectively  addressed. 
The  more  complex  problem  is  to  find  ways  to 
work  collaboratively  with  the  client  while  main- 
taining the  professionally  required  independ- 
ence. 

This  is  not  an  easy  task.  The  American  In- 
stitute of  Certified  Public  Accountants  at- 
tempted  to  ad- 
'    dress  the  commu- 
nications gap 
through  the  work 
of    the  Cohen 
Commission  in 
1978.   The  com- 
mission made 
several  recom- 
— ^i^!^^'^^^— ^^^^^ii^^ii^i^    mendations,  gen- 
erated much  con- 
troversy, but  dissolved  without  having  its  rec- 
ommendations adopted. 

The  trouble  with  its  recommendatioris  cen- 
tered around  suggestions  for  altering  the  stan- 
dard report  format.  Auditors  are  not  inclined  to 
tamper  with  a  format  that  specifies  in  an  organ- 
ized, defensible  manner  the  information  they  are 
required  to  report. 

The  answer  to  the  problem  then  lies  outside 
the  auditor's  report.  Auditors  must  do  a  better 
job  of  communicating  the  role  and  limitations  of 
the  audit  process.  A  Lou  Harris  poll  for  the 
Financial  Accounting  Standards  Board  (1985) 
found  that  two-thirds  of  the  resporKJents  stated 
that  qualitative  information  outside  the  auditor's 
report  was  more  useful  to  them  than  the  quan- 
titative information  in  the  report. 

This  suggests  that  well-conducted  entrance 
and  exit  interviews,  management  letters,  as  well 
as  conferences  during  the  engagement,  play  an 
increasingly  important  role  in  the  audit  process. 
This  is  supported  by  a  Canadian  Institute  of 
Chartered  Accountants'  report  which  found  a 
growing  expectation  and  desire  by  the  auditees 
for  "early  warnings"  of  poor  financial  decision- 
making. 


Information  given  to  the  client  must  be  more 
than  useful;  it  must  be  defensible.  Robert 
Mcdnick  {Journal  of  Accountancy,  1986)  states 
that  "It  would  be  damaging  for  an  auditor  to 
attest  in  any  fashion  to  information  on  which  he 
or  she  had  no  basis  for  credibility."  It  may  be 
difficult  for  auditors  to  evaluate  management 
effectiveness;  however,  they  can  properly  assist 
auditees  with  testing  and  evaluating  their  man- 
agement decision-making  machinery. 

Some  argue  that  this  type  of  assistance  is  the 
realm  of  management  or  performance  audits, 
and  not  financial  and  compliance  audits,  and 
should  therefore  be  referred  to  as  "management 
consuhing,"  not  auditing.  Whatever  it  is  called, 
if  it  makes  the  information  gathered  by  auditors 
more  useful,  maybe  it  is  time  to  incorporate  such 
analysis  into  the  audit  process. 

The  professional  government  auditor  can 
meet  these  new  challenges.  The  Yellow  Book's 
guidelif)es  and  regulations  have  been  revised 
twice  since  1972  in  order  to  support  this  ex- 
panded role.  In  government  there  is  no  longer 
room  for  strictly  financial  audits;  as  described 
above,  every  audit  takes  on  aspects  of  the 
nianagement  audit.  The  financial  audit  now 
includes,  at  a  minimum,  compliance  auditing 
with  observations  about  whether  the  government 


program  is  being  managed  economically,  effec- 
tively and  efficiently  and/or  whether  the  pro- 
gram is  achieving  its  intended  results.  The 
auditor  also  now  reports  on  the  adequacy  of 
internal  controls  and  on  compliance  with  laws 
and  regulations. 

The  challenge  is  to  make  audit  information 
useful  to  the  recipients  of  the  report.  More  ef- 
fective communication,  while  safeguarding 
requisite  independence,  appears  to  be  the  an- 
swer. There  should  be  little  controversy  in  this 
proposition.  The  professional  standards  will  be 
met;  the  report  format  will  be  intact;  and  the 
client  will  be  able  to  make  better  use  of  the 
reported  information  in  improving  agency  op- 
erations. ■ 

References 

Dirsmith,  Mark,  and  Blank,  Mark.  "Contracting  for 
an  Extension  of  External  Auditor  Services." 
International  Journal  of  Government  Auditing 
(October  1987). 

Mcdnick,  Robert.  'The  Auditor's  Role  in  Society: 
A  New  Approach  to  Solving  the  Perception  Gap." 
Journal  of  Accountancy  161  (February  1986): 
70-74. 

'The  Changing  Mix  of  Professional  Services."  An 
unpublished  report  of  The  Caiudian  Institute  of 
Chartered  Accountants  (1985). 


Operational  Auditing 


Operational  auditing,  also  known  in  the  pro- 
fession as  performance  auditing  and  ex- 
panded scope  auditing,  is  being  viewed 
today  as  a  must  for  government.  The  American 
Institute  of  Certified  Public  Accountants 
(AICPA)  defines  this  process  as  "a  systematic 
review  of  an  organization's  activities  in  relation 
to  specified  objectives."  An  operational  audit 
is  conducted  from  the  viewpoint  of  management 
and  considers  both  past  arxl  present  performance 
for  the  purpose  of  improving  future  opera- 
tions. 

In  the  1983  issue  of  Topics  in  Health  Care 
Financing,  Knoll  and  Howard  suggest  that  po- 


tential benefits  resulting  fi^om  the  operational 
audit  process  are  the  formulation  of  recommen- 
dations for  improvement.  These  recommenda- 
tions are  the  expected  outputs  from  an  opera- 
tional audit.  They  derive,  in  part,  from  a  review 
of  the  objectives  of  a  particular  organization  or 
the  organization's  operating  environment,  or- 
ganizational structure,  and/or  operating  plans 
and  policies  toward  personnel  and  physical  fa- 
cilities. All  of  these  factors  are  considered  in 
terms  of  their  contribution  to  operating  effi- 
ciency and  cost  savings. 

Continued  on  page  6 


New  Focus  for  Operational  Auditing 


In  the  mid  1960s,  the  public  sector  began  an 
unprecedented  growth  spurt.  From  1966  - 
1976  federal  spending  rose  from  $134  billion 
to  $375  billion  per  year.  New  government  pro- 
grams, aimed  at  improving  education,  welfare, 
healthcare,  and  employment,  promised  to  affect 
the  quality  of  life  for  all  citizens.  Recognizing 
the  enormous  complexity,  cost  and  potential 
impacts  of  new  social  and  economic  programs, 
and  in  response  to  the  increasingly  complicated 
needs  of  these  new  programs,  the  audit 
profession's  function  has  greatly  expanded 

The  central  audit  question  —  "Is  this  program 
accomplishing  its  purpose,  and  if  so,  is  it  fiscally 
responsible?"  —  demands  the  development  of 
creative  techniques  for  evaluating  program 
results.  New  methods  of  assessing  program 
effectiveness  must  consider  certain  typical 
characteristics  of  these  particularly  complex 
audits.  For  instance,  many  social  and  economic 
programs  are  designed  to  work  inter-depen- 
dently,  resulting  in  multi-directed  funding  and 
service  delivery  structures.  Program  goals  are 
often  articulated  as  political  statements  rather 
than  as  measurable  (easily  evaluated)  objec- 
tives. The  auditor  is  often  called  upon  to  work 
with  the  auditee  to  specify  and  develop  the 
criteria  by  which  the 
auditee  will  be 
evaluated.  Finally, 

the  outcomes  of  Preventative 

these  programs  are 

often     subjective  COSt  SavingS 

(such  as  improved  HI* 
quality  of  Ufe)  and  etleCtlVeneSS. 

^..^.w  . — V.        —      difficult  to  attribute 

to  one  causal  inter-  ^1^;;;=;;;;;;:=;;=;;;;;;;;;;;;;:^=^;;^;;;;;^^ 


These  and  other  challenges  in  program  results 
auditing  have  led  to  the  development  of  new 
concepts  and  approaches  that  now  affect  the 
entire  audit  profession.  A  few  of  these  ap- 
proaches, as  presented  in  professional  articles, 
are  highlighted  in  the  paragraphs  that  follow. 
After  each  of  the  audit-types  described  below, 
there  are  examples  of  audits  completed  or 
underway  by  the  Office  of  the  State  Auditor 
(OSA),  as  well  as  statements  of  why  and  why  not 
an  audit  organization  might  select  that  approach. 


The  Integrated  Management  Audit 

In  order  to  assure  taxpayers  that  government 
managers  are  meeting  all  aspects  of  accountabil- 
ity (financial/compliance,  economy/efficiency, 
and  program  results),  audits  are  now  being  de- 
signed to  review  all  these  areas  in  a  given  audit. 
Such  an  integrated  audit  may  be  accomplished 
by  using  different  audit  organizations  or  teams 
through  cooperative  planning,  or  with  one  audit 
organization  using  a  multi-disciplined  staff. 
Professional  auditors  and  evaluators  are  increas- 
ingly being  recruited  from  diverse  backgrounds 
to  effectively  research  the  subjects  being  audited 
and  to  address  the  complex  needs  of  manage- 
ment. Examples  of  this  type  audit  include  the 
OSA's  audits  of  the  Commonwealth's  homeless 
programs  and  its  child  welfare  programs. 

Why:  Covers  all  aspects  of  public  ac- 
countability including  the  areas 
where  different  audit  types  overlap 
for  the  mo.st  thorough  and  useful 
audit  results. 

Why  Not:  Requires  extensive  time  for 
both  planning  and  execution  aiKl 
requires  auditors  with  diverse 
expertise  and  abilities. 


auditing  may  result  in 
and  enhanced  program 


The  Preventative  Audit 

In  many  new  and  ongoing  governmental  proj- 
ects, audits  are  being  implemented  when  pro- 
gram planning  begins  and,  therefore,  are  incor- 
porated as  an  integral  part  of  program  operation. 
Auditors  participate  in  the  planning  process,  set 
measurable  program  objectives  and  reporting 
systems,  project  results,  and  institute  systems  of 
control  and  reporting.  Preventative  auditing 
may  result  in  cost  savings  and  enhanced  pro- 


gram  effectiveness.  In  social  programs  where 
resources  are  rarely  allocated  for  self-evalu- 
ation, the  preventative  audit  can  establish  meas- 
urable goals  and  ongoing  evaluation  procedures. 
For  building  or  transportation  construction 
projects,  the  preventative  audit  can  enhance  the 
efficiency  of  siting  and  procurement  procedures. 
A  preventative  audit  may  also  serve  to  re-evalu- 
ate the  need  for  change  during  program  planning 
and  implementation.  Examples  of  this  type  audit 
include  the  Non-Tax  Revenue  Audit  and  the 
Massachusetts  Water  Resources  Authority  Audit 
currently  being  urnlertaken  by  the  Massachusetts 
Auditor's  Office. 

Why:  Catches  costly  planning  and  im- 
plementation mistakes  in  process. 
Management  learns  to  consider  the 
audit  as  a  standard  and  necessary 
portion  of  operations. 

Why  Not:  Requires  an  entirely  different 
type  of  audit  involvement  and 
extended  survey  and  is  more 
costly.  Audit  product  is  the  en- 
hanced operation  of  the  program 
and  not  post-period  audit  results. 

Utilization-Focused  Audit 

Modem  audit  techniques  have  become  more 
focused  on  meeting  the  legitimate  needs  of  the 
auditee  through  the  positive  presentation  of 
ways  to  improve  effectiveness.  The  focus  has 
shifted  in  this  type  of  auditing  from  emphasizing 
evaluation  of  past  performance  to  the  promotion 
of  recommendations  for  improving  future  opera- 
lions.  The  interview  is  used  to  draw  on  the 
experience  of  the  auditee 's  on-site  employees 
who  are  usually  aware  of  the  important  opera- 
tional problems.  Auditee's  ideas  are  incorpo- 
rated into  the  audit  process  and  conclusions, 
thereby  increasing  the  chances  that  recommen- 
dations will  result  in  action.  Audit  tests  are 
selected  based  on  the  composite  of  information 
gained  through  interviews  and  evidence  gather- 
ing, and  audit  reports  include  statements  of  the 
auditee's  successful  efforts  and  initiatives.  An 
example  of  this  type  audit  is  the  Massachusetts 
Bay  Transportation  Authority  Audit  most  re- 
cently issued  by  the  Office  of  the  State  Auditor, 


Why:  May  result  in  more  useful  recom- 
mendations and  an  environment 
primed  for  implementation. 

Why  Not:  Requires  an  increased  time 
commitment  from  all  parties. 
There  is  some  lack  of  defined  audit 
techniques  and  procedures.  Quali- 
tative methods  such  as  interviews 
and  observations  require  that  audi- 
tors receive  certain  non-traditional 
training. 

As  a  result  of  the  OSA's  desire  to  be  a  more 
active  and  productive  participant  in  the  deci- 
sion-making regarding  the  funding  and  manage- 
ment of  state  initiatives,  it  has  become  more 
aware,  responsive  and  creative  in  designing  spe- 
cial scope  audits.  This  commitment  to  enhance 
state  audits  will  bring  the  Massachusetts  Office 
of  the  State  Auditor  to  the  forefi^ont  of  the 
auditing  profession.  ■ 
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operational  Auditing 


Continued  from  page  3 

According  to  Knoll  and  Howard,  operational 
auditing  focuses  on  the  compliance,  efficiency, 
effectiveness,  economy  and  results  of  the  opera- 
tions of  an  organization.  "Compliance"  focuses 
on  the  degree  of  adlierence  to  applicable  laws 
and  regulations.  "Effectiveness"  addresses  the 
results  or  outputs.  "Efficiency"  relates  to  the 
usage  of  resources  or  inputs  to  produce  results. 
"Economy"  applies  to  avoiding  costs  or  gener- 
ating income  in  the  operation  of  the  program  as 
activity. 

Robert  Rector,  in  "Operational  Auditing: 
What  It's  All  About,"  states  that  developing  the 
audit  results  is  an  important  part  of  the  audit 
from  the  standpoint  of  proving  the  value  of  the 
total  audit  service.  The  audit  result  reflects  in 
totality  the  outcome  of  the  entire  audit  effort. 
The  elements  or  attributes  of  a  well-writteu 
audit  result  are: 

•  Condition  (what  is) 

•  Criteria  (what  should  be) 

•  Cause  (why) 

•  Effect  (material  or  significant  impact  on 
program,  activity,  organization  or  financial 
statement) 

•  Recommendation  (what  must  be  done  to 
rectify  the  problem). 

The  culmination  of  the  audit  is  the  recom- 
mendation referring  to  the  types  of  action  which 
should  be  taken. 

When  the  Office  of  the  State  Auditor  (OS A) 
issues  its  new  audit  policy  and  procedures 
manual,  the  fifth  attribute,  the  recommendation, 
will  be  expanded  to  include  "the  benefits  of  the 
recommendation."  This  will  afford  the  auditor 
the  opportunity  to  demoastrate  what  will  be  the 
sj)ecific  benefits  of  complying  with,  or  imple- 
menting, the  recommendations.  Furthermore, 
we  need  to  emphasize  that  the  audit  result  also 
presents  a  balanced  and  complete  report.  A 
balanced  report  describes  what  the  auditee  has 
done  or  intends  to  do  about  our  recommenda- 
tions and  whether  we  agree  with  those 'actions. 
Then  the  Legislature  and  oversight  agencies  are 
equipped  to  act. 


The  OSA  has  taken  the  lead  in  state-of-the- 
art  report  writing  by  more  appropriately  redefin- 
ing the  concept  known  as  an  "audit  finding"  to 
an  "audit  result."  The  new  audit  manual  will 
explain  not  only  the  policy  of  the  OSA  but  also 
audit  procedures  and  forms  to  be  used  to  assist 
the  auditor  in  conforming  with  GAGAS. 

As  a  result  of  a  more  expanded,  progressive 
audit  approach  and  reporting,  the  OSA  has 
begun  to  play  a  more  effective  role  in  the  finan- 
cial planning  and  decision-making  at  the  pro- 
gram management  and  budgeting  level  on  a 
statewide  basis.  (Examples:  audits  of  non-tax 
revenue,  trust  funds,  and  court  facilities  in  the 
OSA's  Audit  Plan  for  1988.)B 
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Accuracy  Is  Not  Enough:  ^tP  2  01990 

The  Yellow  Book's  Fourth  Reporting  Standard  J^<NBTS\t\/  Of  /l/l^ao^.^  .   

Brevity,  clarity,  completeness,  and  persua- 
siveness are  well-established  writing  principles, 
and  they  serve  to  explain  the  selection  and  ar- 
rangement of  details  and  words  in  a  report  in 
_____________        terms  of  a  report-reader's  under- 
standing and  accepting  the  audit 
The  report         disclosures.'   Thus  report-writers 
should  be  ^^^^      think  not  only  about  cor- 

rectness but  about  appropriateness 
complete,  and  effecUveness  as  well/ 

accurate,  The  diverse  readership  of  audit 

.  .  reports  of  course  makes  certain 

ODjeCllVe,  writing  decisions  difficult.  To  take 

Sindi  example:  A  report-writer  con- 

.      ,  eludes  that  a  local  housing  author- 

COnVinCmg,  j^y  (LHA)  did  not  comply  with 
and  be  as  when  the  LHA  awarded  a 

landscaping-services  contract  with- 
Clear  and  out  first  soliciting  competitive  bids, 

concise  as  should  the  report-writer  merely 

cite  (or  paraphrase)  the  relevant 
the  subject  competitive-bidding  statute?  Or 
matter  would  it  be  more  appropriate  (or 

more  effective)  to  quote  verbatim 
permits.  specific  passages  from  the  statute? 

  And,  if  deemed  more  appropriate,   

""""^^"""""^        how  much  of  the  statute  needs  to 

be  quoted?    At  a  minimum,  the   

LHA's  executive  director  and  board  members 

and  the  cognizant  oversight  officials  —  in  this   

case,  Executive  Office  of  Communities  and  De- 
velopment (EOCD)  personnel  —  will  have  the   
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The  Yellow  Book's  reporting  standards  re- 
quire auditors  to  review  (and  to  revise  if 
necessary)  draft  reports  not  only  with  an  eye 
for  factual  accuracy  but  also  with  a  concern  for 
report- readers  —  their  back-  _____ 
grounds,  interests,  and  expecta- 
tions. '    Accordingly,  auditors-in- 
charge  (AICs),  who  generally 
write  first  drafts,  review  them 
primarily  to  ensure  that  facts, 
opinions,  and  conclusions  are 
adequately  supported  by  evidence 
contained  in  the  workpapers.  In 
all  likelihood,  however,  a  single 
review  of  most  reports  will  not 
adequately  address  the  Yellow 
Book's  reporting  requirements. 
Most  reports  must  be  reviewed  a 
second  time  by  AICs  —  this  time 
as  if  they  had  never  done  the  au- 
dits and  had  no  access  to  the 
workpapers  —  for  that  is  pre- 
cisely the  situation  in  which  most 
report-readers   find  themselves. 
Based  on  this  second  review, 
AICs  can  rewrite  first  drafts,  veri- 
fying in  the  workpapers  any  revi-  ami^^^ 
sions  or  additions.    The  fourth 
reporting  standard,  in  particular,  focuses  on  the 
report-reader's  understanding  of  the  audit  dis- 
clo.sures: 

The  report  should  be  complete,  accurate, 
objective,  and  convincing,  and  be  as  clear 
and  concise  as  the  subject  matter  permits.^ 


OSA  Office  of  the  State  Auditor 


A.  Joseph  DeNucci,  Auditor  of  the  Commonwealth 
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Continued  from  page  1 

opportunity  to  read  the  audit  results,  including 
the  criteria  attribute.  The  report-writer  must 
decide  how  to  present  most  effectively  the  cri- 

  teria  so  that  the  various  report-readers  are  con- 
vinced that  the  relevant  statute  has  not  been  fol- 

  lowed  by  the  LHA  in  this  particular  instance.' 

Report-readers  at  the  LHA,  as  well  as  those 

outside  the  auditee,  need  to  understand  that 

complying  with  state  purchasing  regulations  can 

save  money  whenever  the  auditee  procures 

goods  and  services.    The  report-writer  once 

again  must  decide  on  how  to  present  the  effects 

of  noncompliance.    Exaggerating  the  effects 

could  undermine  the  report's  credibility;  not 
  explaining  them  could  leave  open  to  question 

the  materiality 
  of  the  disclo- 
sure. 

compiicaung   Report-writcrs  must  consider 
such  decisions         lyj^^^  grammar  and  spelling, 

IS  the  fact  that  j         o  i- 

one  reporting    but  the  report-reader 's  overall 

Standard   can  ■  ■•  ■ 

affect  another   grasp  01  the  audit  results. 

  standard.  That 

the  effort  to  be  i  i 

  concise  can  af- 
fect the  necessity  to  be  complete  is  an  obvious 

  example.    To  take  a  less  obvious  example: 

Auditors  are  required  by  the  standards  to  pres- 

  ent  their  audit  results  objectively  and  convinc- 
ingly; however,  imagine  a  first-draft  report  dis- 

  closing  numerous  instances  of  a  fiscal  officer's 

ineptitude.  The  examples  are  provided  to  per- 

  suade  report-readers  that  during  the  audit  period 

weak  recordkeeping  practices  existed  at  a  state 
agency.  But  as  the  Yellow  Book  cautions,  re- 
port-writers must  guard  against  "the  tendency 
to  exaggerate  or  overemphasize  deficient  per- 
formance."* How  many  specific  examples 
should  be  included  in  the  report  to  establish 
convincingly  the  validity  of  the  audit  results? 
That  question  answered,  a  second  question,  one 

z 


concerning  objectivity,  has  to  be  addressed: 
Could  the  proposed  number  of  examples  ap- 
pearing in  the  draft  report  be  construed  as  over- 
emphasizing deficient  performance? 

In  short,  report-writers  must  consider  not  just 
grammar  and  spelling,  but  the  report-reader's 
overall  grasp  of  the  audit  results.  Consideration 
of  report-readers  means  that  report-writers 
should  avoid,  for  example, 

•  Assuming  that  all  report-readers  will  ac- 
cept as  compelling  evidence  such  general 
criteria  as  "EOCD  guidelines"  (a  matter 
of  convincingness) 

•  Expecting  report-readers  to  figure  out 
how  several  factual  assertions  or  sets  of 
numbers  are  related  (a  matter  of  clarity) 

•  Forcing  report-readers  to  guess  what  hap- 
pened (or 

,^mmmmmmmmmm,mmmm^m,m,^mm,  COUM  haVe 

happened) 
because  an 
LHA  did 
not  comply 
with  appli- 
cable state 
regulations 
(a  matter  of 

  complete- 

ness) 

•  Asking  report-readers  to  wrestle  with  the 
meaning  and  relevance  of  an  accurately 
quoted,  but  densely  worded,  passage  from 
the  General  Laws  (also  a  matter  of  clar- 
ity). 

Such  consideration  ensures  that  report-read- 
ers will  not  have  to  spend  a  good  deal  of  time 
unraveling  the  intended  meaning  and  signifi- 
cance of  an  audit  disclosure.' 

What  three  things  can  report-writers  do  on 
their  own  to  help  them  make  sound  writing  de- 
cisions? 

First,  they  need  to  read  regularly  articles  in 
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two  or  three  professional  journals  (e.g.,  Journal 
of  Accountancy,  Harvard  Business  Review,  and 
so  forth).  Studying  how  other  writers  succeed 
(or  fail)  in  communicating  the  results  of  their 
research  can  help  report-writers  write  more  ef- 
fectively. 

Second,  report-writers  need  to  review  care- 
fully the  comments  of  auditees  and  others  — 
however  defensively  the  responses  may  be 
worded  —  because  those  comments  may  iden- 
tify unclear  passages  or  incomplete  (or  uncon- 
vincing) arguments.' 

Third,  report-writers  can  read  issued  audit 
reports  and  in  this  way  find  out  how  colleagues 


and  supervisors  resolved  particular  reporting 
problems.  This  last  recommendation  should 
not  be  interpreted  as  a  call  for  boilerplate;  but 
report-writers  may,  by  reading  issued  reports, 
discover  the  various  uses  of  (say)  tables,  charts, 
or  photographs.' 

Following  these  three  recommendations  can- 
not guarantee  that  a  report-writer  will  always 
make  the  best  writing  decisions,  but  not  follow- 
ing them  could  mean  that  chance  or  coinci- 
dence, rather  than  a  report-writer's  informed 
professional  judgment,  wiU  govern  the  selec- 
tion and  arrangement  of  elements  of  an  audit 
result. 


Endnotes 

'In  the  second  edition  of  her  Writing  Audit  Reports 
(New  York:  McGraw-Hill,  1984):  Mary  C.  Bromage 
devotes  an  entire  chapter  to  "recognizing  recipients" 
107-116. 

^Government  Auditing  Standards:  Standards  for  Au- 
dit of  Governmental  Organizations,  Programs,  Ac- 
tivities, and  Functions  (1981;  revised  1988):  7-10. 
Strictly  speaking,  the  fourth  reporting  standard 
quoted  here  pertains  to  performance  audits. 

'See.  for  example,  Aristotle's  Rhetoric  or 
Quiiitilian's  Institutes  for  the  earliest,  and  still  some 
of  the  best,  discussions  of  the  art  of  persuasion. 

^For  Bromage,  the  effect  of  a  report  on  readers  is  the 
principal  standard  for  judging  the  quality  of  a  report 
(p.  107).  Although  his  article  focuses  on  internal 
auditing,  Maj.  Leonard  E.  Berry  suggests  several 
ways  of  considering  the  audit  report  from  an 
auditee's  perspective;  see  his  "Arc  You  a  Thick- 
Skinned  Auditor?  "  The  Internal  Auditor  33  (1976): 
45-46,51. 

'Bromage  makes  a  similar  point  when  she  discusses 
"choosing  words"  (p.  15);  however,  the  point  can 
also  apply  to  other  writing  choices  facing  report- 
writers.  In  "A  Recipe  for  Writing  Management  Au- 
dit Reports"  (The  Government  Accountants  Journal 
31  [1982]:  36-43),  Ronell  B.  Raaum  prescribes  a 
standard  organization  for  developing  any  audit  issue 
because  "the  facts  of  an  audit-can  be  organized  in  a 


variety  of  acceptable  ways"  (p.  36).  Raaum's  argu- 
ment is  premised  on  decreasing  tlie  time  it  lakes  to 
review  a  report  and  on  eliminating  writers'  frustra- 
tions. Bui  Raaum  acknowledges  an  important  omis- 
sion in  his  article:  "What  I  caimot  do  well  is  give 
directions  on  how  much  of  each  element  to  use"  (p. 
37).  Reading  articles  in  professional  journals  is  one 
way  of  getting  those  "directions." 

^Government  Auditing  Standards  7-11 

'Marie  Farrell-Donaldson,  former  Auditor  General 
of  Detroit,  Michigan,  discusses  and  illustrates  how 
audit  disclosures  can  be  misinterpreted;  see  her  "In 
the  Public  Spotlight,"  The  Internal  Auditor  41 
(1984):  62-64. 

'In  "The  Audit  Exit  Conference  -  A  Time  for  Profes- 
sionalism" {The  Government  Accountants  Journal, 
32  [1983])  James  R.  Crockett  suggests  that  the  exit- 
conference  draft  report  be  carefully  examined  (and 
revised  if  necessary)  in  light  of  the  auditee's  com- 
ments: "Quality  control  should  be  achieved  as  the 
auditor  reviews  in  detail  a  draft  copy  of  the  audit  re- 
port with  auditee  management  and  others  that  are  in 
a  position  to  offer  valid  criticisms"  (p.  62). 

'Occasionally,  AICs  and  report-reviewers  will  come 
across  rewarding  books  or  articles  on  higlily  special- 
ized writing  topics;  see,  for  example,  Edward  R. 
Tufte's  T/te  Visual  Display  of  Quantitative  Informa- 
tion (Cheshire,  CN:  Graphics  Press,  1983). 


Audit  Engagement  Attitudes  &  Approaches: 

From  Policing  to  Participation 


Auditee 


The  Generally  Accepted  Government  Audit- 
ing Standards  (GAGAS),  which  is  the  offi- 
cial policy  of  the  Office  of  the  State  Audi- 
tor, has  clearly  and  continuously  advocated  a 
more  cooperative,  balanced  and  useful  ap- 
proach to  the  audit  field  work,  the  audit  report, 
and  the  relationship  between  the  auditee  and  the 
auditor.  In  fact,  the  functioning  of  government 
is  heavily  dependent  on  information  exchange 
and  effective  communication.  As  auditors,  we 
are  challenged  to  perform  our  work  with  integ- 
rity and  objectivity  and  to  demonstrate  the 
ability  to  work  effectively  with  other  people, 
while  maintaining  our  independence  and  pro- 
fessionalism. Communication  developed 
within  the  auditee-auditor  relationship  can,  and 
most  certainly  will,  influence  the  implementa- 
tion of  audit  objectives  and  the  overall  useful- 
ness of  the  audit  process.  It  is  not  enough  for  us 
as  auditors  to  profess  good  intentions  and  sim- 
ply offer  to  the  auditee  the  benefits  of  our  serv- 
ices. Rather,  it  is  necessary,  especially  in  ex- 
panded scope  auditing,  to  edu- 
cate the  auditee  about  the  op- 

portunities  of  the  audit  process,       yj^^  burdCIl  of 
to  sell  the  audit  recommenda- 
tions, and  to  persuade  the  au-       reSOlutioil  dHCl 
ditee  of  the  organizational  bene-  1   4-*  i%* 

fits  of  audit  results  implementa-  reiatlOnSllip 
tion(McKamia,  1987).  In  short,       building  fallS 
it  is  necessary  for  auditors  to  , 
undertake  the  work  of  human  HUUltOr. 
relations  in  order  to  ensure  i^^^iiHimi^^ii^^^ii^ 
meaningful  audit  engagements. 

We  are  charged  in  our  auditing  standards  to 
become  skilled  in  effective  communication, 
and  to  strive  to  clearly  communicate  audit  ob- 
jectives, evaluations,  conclusions  and  recom- 
mendations (Bell,  1981).  In  fight  of  the  grow- 
ing understanding  of  the  importance  of  commu- 
nication to  the  audit  process,  it  is  remarkable 
how  little  time  is  invested  in  training  new  pro- 
fessionals in  our  field  to  function  and  prosper 
within  that  inherently  problematic  relationship 
of  auditor-auditee. 


Auditees  traditionally,  as  a  result  of  either 
experience  or  assumption,  distrust  and  fear  au- 
ditors and  the  audit  process.  Inquiries  by  audi- 
tors into  known  problem  areas  produce  natural 
resentment  and  defensiveness  in  auditees.  Au- 
ditors may  be  viewed  as  policing  and  deliber- 
ately setting  out  to  find  fault  (Berry,  1976).  The 
auditee  may  have  been  pan  of  audits  with  only 
negative  results  and  therefore  has  come  to  ex- 
pect few  positive  experiences  from  the  process. 
Furthermore,  an  audit  signifies  more  work  for 
the  auditee  with  few,  if  any,  apparent  benefits 
while  also  interrupting  normal  day-to-day  op- 
erafions  (CoUins,  Munter,  Gately,  1983).  The 
auditee  may  fear  the  audit  as  a  vehicle  of  retri- 
bution or  radical  change  and  may  also  have  a 
history  of  dealing  with  auditors  who  have  been 
arrogant,  unskilled,  or  overly  impressed  with 
the  power  of  the  auditor  position.  They  may  be 
accustomed  to  the  "secret  agent"  approach  to 
auditing,  where  the  auditor's 
objectives  and  activities  are 

 kept  hidden  from  the  auditee 

(Baker,  1978).  These  attitudes, 
whether  grounded  in  experience 
or  myth,  will  seriously  impede 
the  audit  process. 

Auditor 

In  the  other  comer,  we  have 
the  auditor.  Auditors  tradition- 
ally,  as  a  result  of  either  experi- 
ence, assumption,  or  training, 
distrust  and  suspect  the  auditee.   The  auditor 
may  have  experienced  audits  where  the  auditee 
has  obstructed  the  process  by  witliholditig  or 
delaying  information  (Collins,  Munter,  Galcly, 
1983).  They  may  have  been  misled  by  the  au- 
ditee or  been  subject  to  personal  attacks  on  their 
qualifications  or  methods.    The  auditee  nn\y 
have  voiced  support  for  (he  audit  results  and 
recommendations  during  the  audit  field  work, 
only  to  reverse  the  position  or  present  new  in- 
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formation  at  an  exit  conference.  In  some  audit 
organizations,  auditors  are  rewarded  on  the  ba- 
sis of  negative  findings  and  are  therefore  per- 
sonally motivated  to  find  fault  and  be  critical. 

The  auditor  may  also  anticipate  that  the  au- 
ditce  will  dislike  auditors  and  react  to  this  ex- 
pectation. Again,  these  at- 
titudes,  whether  grounded 
in  experience  or  myth,  will, 
if  not  addressed,  prevent 
the  development  of  effec- 
tive communication.  As 
effective  auditors,  we  strive 
to  be  both  cognizant  of,  and 
sensitive  to,  our  own  atti-  ' 
tudes  and  preconceptions 
and  also  to  tliose  of  our  auditees. 

Witholding  Approach 

The  burden  of  resolution  and  relationship 
building  falls  on  the  auditor.  There  are,  in  most 
general  tenns,  two  distinct  approaches  to  audit- 
ing. For  the  sake  of  description,  we  will  call 
the.se  the  "Withliolding  Approach"  and  the 
"Disclosure  Approach"  to  audit  relations.  The 
Withholding  Approach  is  characterized  by  the 
belief  that  auditors  must  be  disliked  to  be  good 
auditors  (Berry,  1976).  In  this  approach,  audit 
objectives,  programs  and  techniques  are  kept 
from  the  auditee.  There  is  little,  if  any,  partici- 
pation by  the  auditee  in  the  audit  process,  and 
communication  during  field  work  is  minimal. 
Problems  identified  by  the  auditors  are  not 
shared  until  the  infonnal  exit,  as  it  is  not  con- 
sidered desirable  that  the  auditee  have  a  chance 
to  "cleiui  things  up." 

Audits  report  inadequacies  but  do  not  in- 
clude what  the  auditee  is  doing  well;  the  audit 
process  is  therefore  one-sided.  The  withholding 
autlitor  will  be  viewed  as  policing,  cooperation 
wUI  be  minimal,  and  the  audit  product  will  be 
necessarily  limited  in  its  usefulness. 


Disclosure  Approach 

The  Disclosure  Approach  is  characterized  by 
regular  communication  and  auditee  participa- 
tion (McKanna,  1987).  The  auditor  essentially 
trains  the  auditee  in  the  audit  process  and  ac- 
cepts input  about  the  audit  scope,  process  and 


The  goal  must  be  to  select  an  audit 
approach  appropriate  to  the  particular 
circumstances  and  to  remain  flexible 
as  audit  relationships  develop. 


objective.  The  audit  is  viewed  as  a  service  to 
nianagement,  the  auditee  is  afforded  opportu- 
nity to  correct  problems,  and  the  auditor  mar- 
kets audit  recommendations  in  order  to  enhance 
the  likelihood  of  implementation.  This  ap- 
proach is  sometimes  described  as  "cooperative 
auditing"  (Berry,  1976).  With  the  trend  to- 
wards increased  management/operational  audit 
activity,  auditors  have  moved  away  from  the 
objective  evaluation  of  records  and  controls  and 
have  assumed  the  responsibility  of  evaluating 
decision-making,  intent,  and  results  (McKanna 
1983).  It  is  in  the  auditor's  best  interest,  when 
engaging  in  an  audit  of  this  type,  to  establish 
open  channels  of  communication,  to  demystify 
the  audit  process,  and  to  encourage  auditee  par- 
ticipation. 

These  descriptions  are,  as  was  noted,  gener- 
alizations. There  are  within  the  Disclosure 
Approach  appropriate  circumstimces  for  with- 
holding. The  descriptions  are  u.sed  as  illustra- 
tions of  how  far  the  audit  field  can  stray  from 
the  business  of  communication.  Auditors  mu.st 
exercise  considerable  discretion  in  the  selection 
of  audit  approach  and  attitude.  The  goal  mu.st 
be  to  select  an  audit  approach  appropriate  to  the 
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particular  circumstances  and  to  remain  flexible 
as  audit  relationships  develop. 

Authors  in  the  area  of  audit  technique  sug- 
gest the  following  in  the  pursuit  of  effective 
auditee-auditor  relations: 

•  Remember  that  auditee  acceptance  and 
support  is  necessary  to  audit  implementa- 
tion and  meaning. 

•  Work  to  improve  interpersonal  skills. 

•  Develop  a  reputation  of  competence.  (Be 
open  and  explicit  regarding  your  experi- 
ence, qualifications  and  limitations). 

•  Be  open  and  initiate  di.scussion  about  the 
audit  process  and  objectives,  sell  recom- 
mendations, describe  benefits  of  implem- 
entation and  impacts  of  not  implementing. 

•  Know  the  auditee  and  the  audit  scope, 
undeistand  what  is  reasonable  in  the  spe- 
cific audit  context. 

•  Realize  that  as  an  external,  independent 
auditor  you  are  able  to  provide  a  unique 
perspective  and  service  to  management 
that  can  improve  the  efficiency  and  effec- 
tiveness of  operations. 

•  Strive  for  technical  competence  and  an 
understanding  of  human  relations. 

It  is  the  policy  of  the  Office  of  the  State  Au- 
ditor to  conduct  audit  engagements  that  are 
characterized  by  a  professional  attitude,  coop- 
eration and  constructiveness.  In  acknowledge- 
ment of  the  importance  of  good  communication 
to  the  audit  process,  articles  will  appear  in  fu- 
ture issues  of  the  Auditor's  Notebook  exploring 
specific  areas  of  communication  and  transac- 
tion in  the  audit  process.  Those  areas  will  in- 
clude: Interviews,  Conferences  (exit,  entrance, 
progress),  Reporting  arid  Recommendations. 
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Internal  Control  Systems:  iJe^l^ssg 

The  Importance  and  Benefits  of  Comprehensive  Internal  Control  Systei^a^Un"^l$ff^husetts 
State  Auditor-Sponsored  Legislation  for  Internal  Controls  at  all  State  Organizsmlfis 


By  Rita  P.  Hull,  PhD,  CPA,  CIA  and  Donald  W.  Hicks.  PhD.  CPA 


When  the  media  brings  to  light  illegal 
practices  involving  pubhc  monies, 
such  as  the  recent  series  of  scandals 
in  the  state's  higher  education  system,  state 
government  officials  find  themselves  under  the 
gun  to  do  a  better  job  of  keeping  track  of  tax- 
payers'  money.  The  result:  Chapter  647  of  the 
Acts  of  1989,  a  law  vv'hich  provides  for  uniform 
accounting  and  reporting  practices  in  the  Com- 
monwealth by  establishing  minimum  internal 
control  standards.  Many  instances  of  white-col- 
lar crime  occur  only  because  an  irresistible  op- 
portunity presented  itself,  not  because  a  person 
was  intent  on  crime  beforehand.  A  good  sys- 
tem of  internal  controls  limits  this  uncovered 
temptation. 

What  Are  Internal  Controls? 

In  the  broadest  sense,  internal  controls  con- 
sist of  the  policies  and  procedures  used  to  safe- 
guard assets  and  resources  and  to  provide  assur- 
ance that  they  are  used  according  to  manage- 
ment's directions  and  in  compliance  with  law 
and/or  regulation.  Thus,  the  objectives  of  inter- 
nal controls  are  to  provide  management  with 
reasonable  assurance  that: 

•  all  revenues  and  expenditures  are  promptly 
recorded  and  accounted  for  to  facilitate  the 
preparation  of  timely  and  rehable  financial 
reports; 

•  programs  are  carried  out  efficiently  and  ef- 
fectively according  to  applicable  law,  regu- 
lation, and  policy; 


•  assets  and  resources  are  used  in  compliance 
with  applicable  laws;  and 

•  assets  are  safeguarded  against  waste,  illegal 
acts  loss,  and  unauthorized  use. 

Next  Page 

The  issue  of  internal  controls  has  been  an 
important  part  of  the  legislative  agenda 
of  the  Office  of  the  State  Auditor.  On 
January  3.  1990,  a  bill  (House  5)  that  I  spon- 
sored, designed  to  improve  internal  controls 
within  state  agencies,  was  signed  into  law  by  the 
Governor.  This  new  law.  Chapter  647  of  the 
Acts  of  1989,  will  help  to  ensure  improved  ac- 
counting practices  while  also  providing  for  pe- 
riodic evaluation,  corrective  action,  and  the  im- 
mediate reporting  of  unaccounted-for  variances 
to  the  Office  of  the  State  Auditor. 

This  article  on  internal  control  systems  will 
detail  the  need  for  the  new  law,  it  will  also 
explain  why  it  is  not  only  important  and  nec- 
essary but  beneficial.  The  authors.  Dr.  Rita 
Hull  and  Dr.  Donald  Hicks,  have  published  in 
many  professional  journals.  At  my  request,  they 
have  combined  their  considerable  expertise  in 
this  comprehensive  overview  on  the  importance 
of  internal  controls. 


OSA 


Office  of  the  State  Auditor 


A.  Joseph  DeNuoci,  Auditor  of  the  Commonwealth 
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Chapter  647  of  the  Acts  of  1989 

The  legislation  which  became  Chapter  647 
was  filed  by  State  Auditor  A.  Joseph  DeNucci 
as  a  result  of  three  years  of  experience  which 
documented  serious  internal  control  weaknesses 
at  many  agencies  subject  to  audit.  Among  them 


Internal  control  policies  and 
procedures  should  be  structured 
enough  to  avoid  confusion  and  yet 
flexible  enough  to  permit  routine 
handling  of  exceptional  events. 


was  the  handling  of  the  state's  $1.1  billion  pub- 
lic college  and  university  trust  funds  collected 
and  controlled  by  the  29  individual  institutions. 
The  audit  revealed  that  $500  million  spent  in 
1987  was  not  subject  to  comprehensive  ac- 
counting, reporting,  or  controls.  As  a  result, 
some  college  officials  had  abused  trust  funds  to 
pay  for  personal  travel,  political  contributions, 
paiidng  tickets,  parties,  and  out-of-court  settle- 
ments. These  abuses  occurred  because  each 
agency  had  been  permitted  to  follow  its  own 
devices  with  no  provision  for  a  system  of 
checks  and  balances  to  insure  that  public  mo- 
nies were  properly  used  and  accounted  for. 
Therefore,  opportunities  were  presented  which 
people  took  advantage  of. 

The  new  law  requires  all  agencies  of  the 
Commonwealth  to  relinquish  their  individual 
practices  and,  instead,  to  develop  a  set  of  poh- 
cies  and  procedures  following  guidelines  issued 
by  the  Office  of  the  State  Comptroller.  The 
minimum  quality  level  of  internal  accounting 
and  administrative  controls  should  include  the 
following  six  attributes: 

I.  Documentation 

Without  documentation  of  the  internal  control 


system,  there  can  be  virtually  no  record  or  con- 
trol over  the  activities  of  an  agency.  Thus,  all 
agencies  would  be  required  to  document  their 
internal  control  systems  and  have  the  documen- 
tation readily  available  for  inspection  by  the 
State  Comptroller,  the  Secretary  for  Admini- 
stration and  Finance,  and  the  State  Auditor.  Al- 
though the  form  and  extent  of  this  documenta- 
tion is  affected  by  the  size  and 
^^^^^  complexity  of  the  agency,  the 
documentation  should  include  in- 
ternal control  procedures,  internal 
control  accountabiUty  systems, 
and  the  identification  of  the  oper- 
ating cycles. 

Documentation  may  take  the 
form  of  a  detailed  narrative,  flow- 
charts, or  both.  Either  type  is  ap- 
propriate  so  long  as  the  flow  of 
documents  and  procedures  are  in 
sequence  and  properly  explained. 

All  internal  poUcies  and  procedures  should 
be  consistent  with  applicable  laws  and  regula- 
tions. They  should  be  clearly  written  and  easily 
understood  by  users.  Additionally,  they  should 
be  organized,  in  an  easUy  understood  manner, 
in  management  directives,  handbooks,  and 
manuals  which  are  regularly  disseminated 
throughout  the  agency.  These  written  policies 
should  identify  responsibiUties  and  authorities, 
and  they  should  provide  a  basis  for  review  and 
evaluation  of  the  internal  control  system  by  the 
staff  of  the  State  Auditor  in  conducting  their 
audits. 


Internal  control  policies  and  procedures 
should  be  structured  enough  to  avoid  confusion 
and  yet  flexible  enough  to  permit  routine  han- 
dling of  exceptional  events.  Thus,  when  docu- 
menting the  system,  consideration  must  be 
given  as  to  the  amount  of  discretion  allowed 
employees  in  carrying  out  their  duties.  Obvi- 
ously, the  potential  for  abuse  is  greater  as  more 
discretion  is  permitted. 

n.  Recording  of  Transactions  and  Events 
A  system  of  well-designed  forms  and  docu- 
ments is  essential  to  provide  a  record  of  the  en- 


tire  process  or  life  cycle  of  a  transaction  or 
event.  Transaction  or  operating  cycles  within  a 
particular  agency  depend  upon  the  nature  of  the 
agency's  activities;  however,  control  proce- 
dures should  be  in  place  to  ensure  that  all  vahd 
transactions  —  and  only  those  —  are  recorded 
promptly,  accurately,  and  completely  in  the  ac- 
counting records.  For  example,  one  widely 
used  internal  control  device  to  insure  that  all 
valid  transactions  are  recorded  is  the  use  of  pre- 
numbered  documents.  These  numbers  provide 
control  over  the  number  of  documents  issued 
and  recorded. 

in.  Execution  of  Transactions  and  Events 

Authorization  procedures  are  of  overriding  im- 
portance in  providing  a  reliable  system  of  inter- 
nal controls.  Control  procedures  are  necessary 
to  insure  that  transactions  are  authorized  and 
executed  only  by  individuals  acting  within  the 
scope  of  their  authority.  All  authority  neces- 
sary to  the  agency  should  be  delegated  by  the 
agency  head.  The  scope  of  authority  should  be 
clearly  written  and  made  known  and  available 
to  both  supervisors  and  employees.  Staff  mem- 
bers should  be  instructed  to  perform  only  those 
tasks  which  have  been  authorized. 

rv.  Separation  of  Duties 

The  primary  appUcation  of  separation  of  duties 
hinges  on  the  premise  that  the  responsibility  for 
authorization,  custody  and 
recording  should  be  as- 
signed to  different  depart- 
ments and  people.  Separa- 
tion of  duties  serves  several 
purposes  Aside  from  the 
objectives  of  internal  con- 
trols, it  is  usually  more  effi- 
cient to  specialize  tasks. 

More  importantly,  how-   

ever,  this  key  internal  con- 

trol  procedure  serves  as  a 

deterrent  to  illegal  acts  or  the  concealment  of 

an  error.  For  example,  separation  of  duties  in 

procurement  would  require  that  one  individual 

would  justify  and  request  the  purchase,  another 

would  place  the  order,  another  would  acknowl- 


edge the  receipt,  another  would  approve  pay- 
ment, and  still  another  would  pay.  Unless  two  or 
more  of  these  individuals  collude,  there  is  little 
opportunity  for  errors  or  improper  use  of  re- 
sources. 

V.  Supervision 

The  minimum  level  of  quality  acceptable  for 
internal  control  systems  requires  continuous  su- 
pervision by  qualified  individuals  capable  of 
communicating  duties  and  responsibilities  to  staff 
employees.  To  ensure  that  internal  control  objec- 
tives are  achieved,  supervisors  should  also  peri- 
odically review  staff  members'  work.  Supervi- 
sion is  essential  to  control  activities:  without 
supervision,  the  best  internal  control  systems  run 
the  risk  of  becoming  inconsistent  and  unreliable 
because,  when  employees  are  under  pressure, 
there  is  a  temptation  to  b>Tpass  procedures.  Ade- 
quate supervision  is  a  means  of  preventing  and/or 
correcting  weaknesses  in  the  system. 

VI.  Access  to  and  Accountability  for  Resources 

Access  controls  are  essential  in  safeguarding  as- 
sets and  insuring  reliable  record-keeping.  Physi- 
cal precautions  are  necessary  to  limit  access  to 
only  those  individuals  authorized  by  the  agency 
head.  Although  physical  controls  are  commonly 
thought  of  in  connection  with  direct  access  to 
cash  and  other  negotiable  assets,  physical  con- 
trols are  also  necessary  for  records  and  other 


Control  procedures  are  necessary  to 
insure  that  transactions  are  authorized 
and  executed  only  by  individuals  acting 
within  the  scope  of  their  authority. 


documentation  to  avoid  alteration  of  records  and 
unused  forms. 

Accountability  requires  that  periodic  compari- 
sons be  made  between  the  accounting  records  and 
Continued  on  page  6. 


Implementing  the  ''Yellow  Book'' 

in  Massachusetts 


By  Joseph  A.  McHugh,  Phd,  CIA,  CCA,  CMA 

The  Auditor  of  the  Commonwealth  of 
Massachusetts,  A.  Joseph  DeNucci,  re- 
cently published  an  updated,  expanded, 
and  highly  useful  Audit  Policy,  Procedures  <& 
Forms  Manual.  All  auditors  of  governmental 
activities  are  aware  that  major  changes  have 
been  occurring  rapidly  within  the  auditing 
profession  lately.  Publication  of  the  revised 
Governmental  Auditing  Standards  (the  "Yellow 
Book")  by  the  U.S.  General  Accounting  Office, 
the  "expectation  gap"  standards  by  the  Ameri- 
can Institute  of  Certified  Public  Accountants 
(AICPA),  and  other  pronouncements  affecting 
government  entities  require  translation  and 
documentation  if  staff  audit  efforts  are  to  meet 
organizational  and  professional  norms.  This 
manual  helps  auditors  perform  those  tasks. 

An  examination  of  the  updated  manual's 
fourteen  sections  reflects  the  breadth  of  effort 
exp>ended  in  developing  and  promulgating  offi- 
cial state  audit  policy,  standards,  and  procedures 
in  order  to  estabUsh  acceptable  levels  of  per- 
formance in  the  conduct  of  audits.  The  intro- 
duction establishes  the  audit  poUcy  manual  as 
the  definitive  guide  for  conducting  audits  by  the 
Office  of  the  State  Auditor  (OSA)  personnel,  for 
resolving  questions  about  miplementation  and 
also  for  use  as  a  training  guide. 

Section  n  sets  forth  the  role  and  mission  of 
the  OSA  as  being  a  "catalyst  of  good  govern- 
ment by  promoting  economy,  efficiency,  and 
effectiveness  in  state  government."  The  respon- 
sibilities of  staff  in  performing  a  variety  of  func- 
tions from  financial  statement  attest  to  f)erform- 
ance  and  program  results  audits  are  defined.  But 
more  important  than  the  mere  definition  of  the 
types  of  audits  to  be  conducted  is  the  expression 
of  the  State  Auditor's  intent  to  lead  a  responsive 
and  progressive  organization  which  will  assist 
the  Legislature  and  state  managers  to  become  ef- 
fective financial  managers  as  well.  Auditors  are 
viewed  not  only  as  an  integral  part  of  the 
accountability  process,  but  also  as  an  objective 


force  for  fair  and  unbiased  analysis.  Such 
independence  and  objectivity  is  reinforced 
specifically  in  the  details  of  the  Code  of  Ethics 
contained  in  Part  HI.  Section  FV  presents  a 
modified  version  of  "Generally  Accepted  Gov- 
ernment Auditing  Standards"  (GAGAS)  with 
specific  reference  to  the  AICPA 's  Codification 
of  Statements  on  Auditing  Standards  which  are 
incorporated  therein. 

Structurally,  OSA  audit  operations  is  com- 
posed of  five  divisions,  each  of  which  is  headed 
by  a  Director  who  reports  to  the  I>eputy  for 
Audit  Operations. 

These  divisions  are: 

1 .  The  Division  of  State  Audits  which  is  respon- 
sible for  auditing  state  agencies; 

2.  The  Division  of  Authority  Audits  which 
audits  local  housing  and  redevelopment  au- 
thorities, as  well  as  the  Executive  Office  of 
Communities  and  Development; 

3.  The  Division  of  Federal  Audits  which  con- 
tracts to  perform  audits  of  a  variety  of  fed- 
erally assisted  programs  primarily  in  Housing 
and  Urban  Development  and  the  Environ- 
mental Protection  Agency; 

4.  The  Division  of  Contract  Audits  which 
examines  the  Commonwealth's  contract 
management  systems  and  contracts  estab- 
hshed  thereby,  and 

5.  The  Division  of  Audit  Planning,  Policy, 
Quality  Assurance,  and  Report  Processing 
which  oversees  the  management  and  quality 
control  of  the  audit  process. 

Section  VI  encompasses  the  financial  audit 
process  and  the  standards  for  planning, 
fieldwork,  and  reporting  thereon.  Specific 
guidance  is  included  for  each  step  in  the  process, 
and  very  valuable  flow  charts  are  included 
which  not  only  portray  the  flow  of  financiiil 
audits  from  planning  through  reporting,  but  also 
identify   both   participants   and  reviewers 


4 


Auditors  are  viewed  not  only  as  an 
integral  part  of  the  accountability 
process,  but  also  an  objective  force 
for  fair  and  unbiased  analysis. 


involved  in  each  of  the  significant  steps.  Section 
VII  provides  the  same  guidance  for  performance 
audits;  such  guidance  is  parti culariy  valuable 
since  the  theory  and  practice  of  performance 
auditing  are  less  well  defined  than  those  for 
financial  audits. 

Section 
Vin  provides  — — 
about  thirty 
exhibits  of 
standard  forms 
used  in  the  ad- 
ministration of 
an  audit.  Sec- 
tion  DC  pro- 
vides   a   de-  ~ 
tailed  discus- 
sion of  the  quality  assurance  process  required  by 
GAGAS'  fourth  general  standard,  and  Section  X 
provides  a  detailed  discussion  of  the  study  and 
evaluation  of  internal  control  systems.  The 
increased  emphasis  placed  upon  internal  control 
evaluations  as  a  result  of  the  "expectation  gap" 
standards  makes  this  a  particularly  important 
section.  Its  value  is  enhanced  by  Appendix  B, 
a  sample  internal  control  questionnaire,  which 
provides  a  comprehensive  sampling  of  internal 
control  questions  for  specific  engagements. 
This  is  buttressed  by  Appendix  C,  which  con- 
tains a  compendium  of  illustrative  audit  proce- 


dures to  be  incorporated  in  a  preliminary  audit 
survey  and/or  audit  program  design. 

Section  XI  describes  procedures  for  devel- 
oping a  sampling  plan  and  obtaining  the  ap- 
propriate samples.  Section  Xn  prescribes 
working  paper  policy  and  procedures,  while 

Section  XIII 
— ^^^^^^^      provides  com- 
prehensive 
guidance  on 
reports.  Valu- 
able materials 
are  contained 
in  the  appen- 
dices, includ- 
^^^^^i^i^a^^^ii^^      ing  the  legis- 
lative man- 
date of  the  State  Auditor,  materials  on  inter- 
nal controls,  the  substantive  tests  mentioned 
above,  a  listing  of  external  manuals  and 
guides,  and  an  assistant  audit  manager  review 
checklist. 

The  manual  provides  an  excellent  founda- 
tion for  effective  audits  of  those  functions 
typically  encountered  in  state  environments. 
The  OSA  will  provide  a  copy  of  the  manual 
to  other  government  auditors  upon  request  to: 
The  Office  of  the  State  Auditor,  Deputy  Au- 
ditor's Office,  Room  1819,  One  Ashbunon 
Place,  Boston,  MA  02108. 


Joseph  A.  McHugh  is  a  professor  of  accounting  &  finance  at  the  University  of  Massachusetts/Boston. 
He  lias  been  published  in  many  professional  journals  and  is  a  member  of  AGA,  IIA.  EDPAA,  ASMC. 
AAA.  and  MSCPA. 
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the  physical  assets  on  hand.  The  ftequency  of 
this  comparison  depends  upon  the  vulnerability 
and  value  of  agency  resources.  This  accounta- 
bility hinges  upon  the  traditional  internal  con- 
trol procedure  of  separating  the  record-keeping 
function  from  the  custody  of  assets.  Hence,  if 
adequate  separation  of  duties  is  non-existent, 
comparisons  between  resources  and  records  be- 
come meaningless,  and  thefts  or  losses  can  go 
undetected. 

Agency  Accountability 

Chapter  647  specifies  that  either  an  assistant 
secretary,  assistant  commissioner,  or  deputy  to 
the  department  head  in  each  agency  be  respon- 
sible for  making  certain  that  written  documen- 
tation of  the  agency's  internal  accounting  and 
administrative  control  system  is  on  file.  This 
documentation  will  be  the  basis  for  periodic 
evaluation  within  each  state  agency.  The  law 
also  requires  that  all  differences,  shortages,  or 
thefts  which  are  unaccounted  for  be  reported 
immediately  to  the  Office  of  the  State  Auditor 
for  review.  The  State  Auditor  would  then  re- 
port findings  to  the  appropriate  management  as 
well  as  law  enforcement  officials.  The  State 
Auditor  would  identif>'  the  internal  control 
weaknesses  that  enabled  the  variance  or  theft  to 
occur  and  would  recommend  to  the  appropriate 
agency  official  corrections  and  modifications  to 
the  internal  control  procedures  which,  when 
corrected,  would  minimize  or  preclude  the  re- 
occurrance  of  these  conditions.  Finally,  agency 
officials  would  be  required  to  implement  the 
recommended  policies  and  procedures  immedi- 
ately. 

Conclusion 

The  importance  and  benefit  of  comprehen- 
sive internal  controls  cannot  be  stressed 
enough.  Without  sound  controls,  abuses  and 
discrepancies  such  as  those  recently  uncovered 
in  the  Commonwealth,  are  likely  to  continue  in 
state  government.  The  size  and  scope  of  the 
various  state  agencies  make  it  virtually  impos- 
sible for  elected  officials  to  exercise  personal 


oversight  over  operations.  The  implementa- 
tion of  uniform,  sound  internal  controls  should 
create  substantial  savings  by  strengthening  in- 
tegrity of  fiscal  management  practices  and  by 
protecting  the  state's  assets.  A  good  internal 
control  system  serves  as  an  effective  deterrent 
and  also  can  significantly  reduce  the  detail 
work  necessary  in  an  audit.  State  government 
cannot  afford  to  be  without  good  systems  ot 
internal  controls.  The  costs  are  small;  the 
benefits  are  tremendous. 

Note:  Copies  of  Chapter  647  of  the  Acts  of 
1989,  An  Act  Relative  to  Improving  Internal 
Controls  Within  State  Agencies,  are  av;ulable 
from  the  Office  of  the  State  Auditor,  Room 
1819,  One  Ashburton  Place.  Boston.  MA 
02108, 727-6200. 
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